Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b6348916f4414de…

MALICIOUS

PDF

73.9 KB Created: 2021-05-31 23:24:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 94a692915389759e3751c6f7a741e4d4 SHA-1: 790fdb084c933b195c16945fe74504e96abe6529 SHA-256: 6b6348916f4414de32046f04255d70aeb4181ac6c4580441b8cefab84c9a0307
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or to serve a secondary payload. The document body, though heavily obfuscated, appears to be a lure related to book quotes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wastran.ru/pbw?utm_term=chapter+1+their+eyes+were+watching+god+quotes
    • https://kobivepetere.weebly.com/uploads/1/3/1/8/131871499/8436b5.pdf
    • https://bisimopax.weebly.com/uploads/1/3/0/8/130814127/3492981.pdf
    • https://static.s123-cdn-static.com/uploads/4425238/normal_5fec395d99df8.pdf
    • https://rovinimowi.weebly.com/uploads/1/3/4/6/134682499/silujej.pdf
    • https://fefojaza.weebly.com/uploads/1/3/4/4/134480993/faa439a.pdf
    • https://pavuxutekukos.weebly.com/uploads/1/3/4/7/134704216/zojiwenixobubuvakek.pdf
    • https://bomovote.weebly.com/uploads/1/3/5/3/135398027/rufit-piredipe-wurorakuga-vepabajusumorer.pdf
    • https://cdn-cms.f-static.net/uploads/4374189/normal_604639d142054.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://bupataved.pbworks.com/f/69536127791.pdf
    • https://uploads.strikinglycdn.com/files/4ae8e6ca-a5f1-4c04-be6e-cafddfd1b4ed/tomufolelufiwivebokupol.pdf
    • https://uploads.strikinglycdn.com/files/14d47ec4-1567-4a82-8109-84cd6cdd1fe5/77507313119.pdf
    • https://uploads.strikinglycdn.com/files/cb80bd0c-3735-400d-b0ee-7edee96445e5/58622072537.pdf
    • https://uploads.strikinglycdn.com/files/e9a6f1b9-d484-4fb5-9380-868f8a617690/twilight_breaking_dawn_part_1_watch_online_fmovies.pdf
    • https://uploads.strikinglycdn.com/files/d1535dd2-2d2a-445e-bf5f-2d64c4010445/voyager_legend_bluetooth_headset_pairing.pdf
    • https://uploads.strikinglycdn.com/files/0aaad571-9a81-420f-96a4-3d8804151dfb/sta-rite_t-210wf_sand_filter_manual.pdf
    • http://zopujoxobug.pbworks.com/f/boxers_and_saints.pdf
    • http://kufavuva.pbworks.com/f/why_did_my_grandfather_clock_stop_chiming.pdf
    • http://zemenifinabe.pbworks.com/f/3gp_mobile_movie_hindi_2018_download.pdf
    • https://uploads.strikinglycdn.com/files/f35074d8-0063-47b1-aade-ece89ce0249c/vegovavuwuduwovi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d741.bin
c7e3527d25f136aa996e3ab751cbeb39ca54ea756d776dad0343e9fc25a62dbe		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD741 5580 bytes
font_01_sfnt_off0000ea41.bin
b66dc7063dc46c589de55cc763e8ea5413dc6573763af9fed7e057914d4af53f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA41 10252 bytes
font_02_sfnt_off00010d35.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D35 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.